The operator details are not configured yet (LEGAL_COMPANY_NAME, LEGAL_ADDRESS, LEGAL_REG_ID, LEGAL_VAT_ID, LEGAL_EMAIL). Fill them in before launch.
This policy explains which personal data [not configured] processes when you use handshake, why, on which legal basis, who helps us, how long we keep it and what your rights are.
1. Who is responsible
The controller for personal data processed on handshake (website, web app and apps) is [not configured], [not configured].
For anything about privacy, write to [not configured].
2. What we process
Account data: your name, email address, password (stored only as a hash by our authentication provider), language and appearance settings.
Your card and workspaces: the details, photos, logos and backgrounds you put on your digital business card and public pages; workspaces, roles and invitations.
Contacts you capture: photos of business cards (front and back), the text read from them, notes, voice notes and their transcripts, tasks, statuses and flags.
Handshake emails: the recipient address, your greeting, the subject and the delivery status.
Billing data: Stripe customer and subscription identifiers, plan status and the payer's email address. Card details are handled by Stripe only; we never see or store them.
Technical data: IP address and device information in server logs, QR code scan counts (IP addresses only as a salted hash) and error reports.
3. Why we process it and on which legal basis
To provide the service you signed up for: account, card, capture, CRM, handshake emails and sync (Art. 6(1)(b) GDPR, performance of a contract).
Billing, invoicing and keeping accounting records (Art. 6(1)(b) and (c) GDPR).
Security, preventing abuse, rate limits and fixing errors (Art. 6(1)(f) GDPR, our legitimate interest in a secure and reliable service).
Service emails such as sign-in links, invitations and payment requests (Art. 6(1)(b) GDPR). We send marketing emails only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Contacts you capture: we process them on behalf of you or your company workspace (Art. 28 GDPR). For the people on scanned cards the legal basis is normally the legitimate interest in following up a business contact they handed over (Art. 6(1)(f) GDPR); you are responsible for using their data lawfully.
4. Text recognition and AI
Card photos, voice notes and requests to the assistant are sent to AI models through the Vercel AI Gateway to read text, transcribe and summarise. The model providers process the content only to return the result and, under their API terms, do not use it to train their models. You can always enter a contact by hand instead.
5. Processors
We use these service providers, bound by data processing agreements:
Vercel Inc., USA: hosting, server functions and the AI Gateway.
Supabase Inc., USA: database, authentication and file storage.
Resend (Plus Five Five, Inc.), USA: sending platform emails such as handshakes and invitations.
Stripe Payments Europe Ltd., Ireland: payments, subscriptions and invoices.
AI model providers reached through the Vercel AI Gateway (for example Google, OpenAI or Anthropic): text recognition, transcription and summaries.
Where data is transferred outside the EU/EEA, the transfer is based on the EU–US Data Privacy Framework or on the standard contractual clauses of the European Commission.
6. How long we keep data
Account data: as long as your account exists. It is deleted when you delete your account in Settings → Account.
Workspace data (contacts, notes, files): as long as the workspace exists. When a member leaves a company workspace, the company keeps its contacts.
Handshake and email records: as long as the related contact exists.
Invoices and accounting records: as long as tax and accounting law requires (in the Czech Republic generally 10 years).
Server logs: for a short time, normally no longer than 30 days.
Backups: overwritten in the regular backup cycle, normally within 30 days.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and you can withdraw consent at any time with effect for the future.
You can download your data and delete your account yourself in Settings → Account. For anything else, write to [not configured].
You can also lodge a complaint with a supervisory authority: in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz), or the authority where you live or work.
8. If someone captured your card or sent you a handshake
If a handshake user scanned your business card or sent you a handshake email, that user (or their company) decides how your data is used. Contact them directly, or write to [not configured]: we will pass your request on and, if you wish, block your address from further handshake emails.
9. Cookies and storage on your device
We use only what the service needs: a session cookie that keeps you signed in, your choice of language, appearance and workspace, and an offline outbox on your device (IndexedDB) that holds captures until they are synced. We use no advertising or tracking cookies, so there is nothing to consent to.
10. Security
All connections are encrypted. Access to data is checked in the database itself for every request, secrets such as email server passwords are stored encrypted, and payment data stays with Stripe.
11. Changes
We update this policy when our processing changes. We will tell you about material changes by email before they take effect.